@vincentt-xr/cli 0.7.0 → 0.9.0

package/dist/lib/initCommand.js

@@ -1,12 +1,19 @@
-// `vincentt init [dir]` — scaffold a Vincentt XR app. NO account, NO network call
-// to the API, NO binding written.
+// `vincentt init [dir]` — scaffold a Vincentt XR app. On the BARE path: NO
+// account, NO network call to the API, NO binding written.
 //
 // This is the acquisition wedge: local-first is a smaller room, not a wall, so the
 // template must be reachable without ever touching the auth gate. `create` (which
 // does need an account) is offered at the end as the next thing AVAILABLE, never as
 // a requirement.
+//
+// `--from owner/repo@tag` (f6) adds a SECOND path that clones a gallery template
+// and then registers the project, so it does call the API — for its second half,
+// after the source is on disk. The claim above is scoped to the bare path and
+// stays true of it: no flag added to `init` may make the bare path touch the
+// network (A-5.3).
 import path from "node:path";
-import { detectPackageManager, installDependencies, isNonEmptyDir, needsScaffold, scaffoldFromTemplate, } from "../scaffold/index.js";
+import { ScaffoldRefError, detectPackageManager, installDependencies, isNonEmptyDir, needsScaffold, scaffoldFromTemplate, } from "../scaffold/index.js";
+import { formatSourceRef, templateCloneURL } from "./sourceRef.js";
 /** The folder name offered when `init` is run bare and the creator just hits Enter. */
 export const DEFAULT_APP_NAME = "my-ar-app";
 /**
@@ -81,20 +88,36 @@ export async function initCommand(deps, opts = {}) {
     // version they have no reason to care about.
     if (opts.template)
         deps.print(`  · template ${opts.template}`);
+    if (opts.from)
+        deps.print(`  · from ${formatSourceRef(opts.from)}`);
     const scaffold = deps.scaffold ??
-        ((dir, ref) => scaffoldFromTemplate(dir, { ref }));
+        ((dir, o) => scaffoldFromTemplate(dir, o));
     try {
-        await scaffold(target, opts.template);
+        await scaffold(target, opts.from
+            ? { repo: templateCloneURL(opts.from.owner, opts.from.repo), ref: opts.from.tag }
+            : { ref: opts.template });
     }
     catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
         deps.print("");
-        deps.print(`✗ ${err instanceof Error ? err.message : String(err)}`);
+        if (opts.from) {
+            printFromScaffoldFailure(deps.print, opts.from, isRefFailure(err, msg));
+            return 1;
+        }
+        deps.print(`✗ ${msg}`);
         deps.print("");
         deps.print("  Run `vincentt init` again once that is resolved.");
         return 1;
     }
+    // S-1: the combined path CLONES AND STOPS. No package manager is spawned, and
+    // the refusal is structural — `--from` is rejected in the argument parser
+    // alongside any install-enabling flag, so this branch cannot be re-enabled by
+    // a caller.
     let installed = true;
-    if (!opts.skipInstall) {
+    if (opts.from) {
+        installed = false;
+    }
+    else if (!opts.skipInstall) {
         deps.print("  · installing dependencies");
         const install = deps.install ?? ((dir) => installDependencies(dir));
         try {
@@ -110,7 +133,6 @@ export async function initCommand(deps, opts = {}) {
     const pm = await detectPackageManager(target).catch(() => "npm");
     deps.print("");
     deps.print(`✓ Created ${label}`);
-    deps.print("");
     const steps = [];
     // Keyed off the RESOLVED dir, not the flag — a prompted name needs the cd too.
     if (dir !== ".")
@@ -119,18 +141,71 @@ export async function initCommand(deps, opts = {}) {
         steps.push([`${pm} install`, "Install dependencies"]);
     }
     steps.push([`${pm} run dev`, "Start the local dev server"]);
-    for (const line of alignedSteps(steps))
-        deps.print(line);
+    if (!opts.from) {
+        deps.print("");
+        for (const line of alignedSteps(steps))
+            deps.print(line);
+        deps.print("");
+        deps.print("  No account needed. When you're ready to put it online:");
+        for (const line of alignedSteps([
+            ["vincentt login", "Connect this machine to Vincentt"],
+            ["vincentt create", "Register the project and reserve its address"],
+        ])) {
+            deps.print(line);
+        }
+        return 0;
+    }
+    // S-1's whole UX: two sentences, no apology and no threat model. The install
+    // appears below as an ordinary step, never as a remedy — a creator should
+    // never learn that it is unusual.
+    deps.print("  The source is yours. Dependencies are not installed yet.");
+    // TRAP 4: the scaffold's success is already in the output, and the exit code
+    // still reports the registration half. The `✗` is the last glyph, always.
+    const register = deps.register;
+    if (!register)
+        return 0;
+    const code = await register({ print: deps.print, targetDir: target, dirLabel: label, ask: deps.ask }, { name: opts.name, slug: opts.slug });
+    if (code !== 0)
+        return code;
     deps.print("");
-    deps.print("  No account needed. When you're ready to put it online:");
-    for (const line of alignedSteps([
-        ["vincentt login", "Connect this machine to Vincentt"],
-        ["vincentt create", "Register the project and reserve its address"],
-    ])) {
+    deps.print("  Next:");
+    for (const line of alignedSteps(steps))
         deps.print(line);
-    }
     return 0;
 }
+/**
+ * The scaffold half's failure copy for `--from`, which branches on WHICH repo
+ * was cloned. The shipped "omit --template to use the latest release" advice is
+ * right for the built-in template and meaningless for a gallery source.
+ *
+ * Nothing was written — no `else` — because there is no second half above this.
+ */
+function isRefFailure(err, message) {
+    return (err instanceof ScaffoldRefError ||
+        /has no version|remote branch|couldn't find remote ref/i.test(message));
+}
+function printFromScaffoldFailure(print, from, refMissing) {
+    const named = `${from.owner}/${from.repo}`;
+    if (refMissing) {
+        print(`✗ The repository ${named} has no tag "${from.tag}"`);
+        print("");
+        print("  The gallery card always shows the current reference. If you pasted this command");
+        print("  from somewhere else, it may be out of date.");
+        print("");
+        print("  Nothing was written.");
+        print("");
+        print("  Copy the command again from the gallery and run it.");
+        return;
+    }
+    print(`✗ Could not reach github.com/${named}`);
+    print("");
+    print("  The repository may have been renamed or made private, or your network may be");
+    print("  blocking github.com.");
+    print("");
+    print("  Nothing was written.");
+    print("");
+    print("  Check the command on the gallery card and run it again.");
+}
 /** Two columns, aligned on the widest command, so the block reads as a table. */
 function alignedSteps(steps) {
     const width = Math.max(...steps.map(([cmd]) => cmd.length));

package/dist/lib/initFrom.d.ts

@@ -0,0 +1,48 @@
+import { type SourceRef } from "./sourceRef.js";
+/** How many times the address prompt re-asks before falling back to the printed block. */
+export declare const ADDRESS_REASK_LIMIT = 3;
+export interface RegisterDeps {
+    print: (line: string) => void;
+    /** The scaffolded directory — the cwd the registration acts in. */
+    targetDir: string;
+    /** Label for the resume command (`cd <label>`). */
+    dirLabel: string;
+    /** Free-text prompt. Absent → not a TTY, so nothing may be asked. */
+    ask?: (prompt: string, fallback: string) => Promise<string>;
+    /** Resolve the current PAT, or undefined. Never triggers a login by itself. */
+    currentToken: () => Promise<string | undefined>;
+    /** Run the interactive browser login. Only ever called on a TTY. */
+    runLogin: () => Promise<void>;
+    /** Resolve which org to register in, and where that choice came from. */
+    resolveOrg: () => Promise<{
+        ok: true;
+        name: string;
+        source: OrgSource;
+    } | {
+        ok: false;
+        message: string;
+    }>;
+    /**
+     * f2's shipped `createCommand`, injected. Returns the exit code; it owns the
+     * binding write, which happens ONLY after the 201.
+     */
+    create: (opts: {
+        name: string;
+        slug: string;
+    }) => Promise<number>;
+}
+export type OrgSource = "active" | "env" | "flag";
+export interface RegisterOptions {
+    /** `--name`, read before prompting. */
+    name?: string;
+    /** `--slug`, read before prompting. */
+    slug?: string;
+}
+/**
+ * The registration half. Runs ONLY after the scaffold reported success, so the
+ * source is already on disk in every branch below — which is why every failure
+ * closes with "Nothing else was written." rather than "Nothing was written."
+ */
+export declare function registerAfterScaffold(deps: RegisterDeps, opts?: RegisterOptions): Promise<number>;
+/** The `· from owner/repo@tag` bullet in the start block. */
+export declare function sourceBullet(ref: SourceRef): string;

package/dist/lib/initFrom.js

@@ -0,0 +1,198 @@
+// `vincentt init <dir> --from owner/repo@tag` — the combined clone path (f6).
+//
+// One command, TWO failure domains. Everything above the seam is on disk and
+// permanent; everything below it is a network attempt. The transcript's shape is
+// what lets a creator answer "did I lose my work?" without reading the error.
+//
+// This file is an ORCHESTRATOR plus the bounded re-ask loop plus the transition
+// copy, and nothing else. `ensureLoggedIn` and `createCommand` are called
+// verbatim — a second implementation of f2's rules is a second place for them to
+// be wrong.
+import path from "node:path";
+import { SlugTakenError } from "./backend.js";
+import { slugify } from "./slug.js";
+import { formatSourceRef } from "./sourceRef.js";
+/** How many times the address prompt re-asks before falling back to the printed block. */
+export const ADDRESS_REASK_LIMIT = 3;
+const ORG_SOURCE_LABEL = {
+    active: "from your active workspace",
+    env: "from VINCENTT_ORG",
+    flag: "from --org",
+};
+/** The one sentence every registration-half failure opens with. Byte-identical across arms. */
+function reassure(print, dirLabel) {
+    print(`  Your source is fine — ${dirLabel} is on disk and it's yours.`);
+}
+/** The resume block: `cd <dir>` then the exact create command. */
+function resume(print, dirLabel, command) {
+    print(`  cd ${stripLeadingDotSlash(dirLabel)}`);
+    print(`  ${command}`);
+}
+function stripLeadingDotSlash(label) {
+    return label.startsWith("./") ? label.slice(2) : label;
+}
+/**
+ * The registration half. Runs ONLY after the scaffold reported success, so the
+ * source is already on disk in every branch below — which is why every failure
+ * closes with "Nothing else was written." rather than "Nothing was written."
+ */
+export async function registerAfterScaffold(deps, opts = {}) {
+    const defaultName = opts.name ?? path.basename(path.resolve(deps.targetDir));
+    const defaultSlug = opts.slug ?? slugify(defaultName);
+    const resumeCommand = `vincentt create --name "${defaultName}" --slug ${defaultSlug || "<address>"}`;
+    // TRAP 2 inverted deliberately: the session is checked AFTER the scaffold, and
+    // `ensureLoggedIn` is only reachable on a TTY because it opens a browser.
+    const token = await deps.currentToken();
+    if (!token) {
+        if (!deps.ask) {
+            deps.print("");
+            deps.print("✗ Not signed in, and signing in needs a browser.");
+            deps.print("");
+            reassure(deps.print, deps.dirLabel);
+            deps.print("  No address is reserved yet.");
+            deps.print("");
+            deps.print("  On a machine with a browser:");
+            deps.print("  vincentt login");
+            deps.print("");
+            deps.print("  Then finish:");
+            resume(deps.print, deps.dirLabel, resumeCommand);
+            deps.print("");
+            deps.print("  Nothing else was written.");
+            return 1;
+        }
+        deps.print("");
+        deps.print("→ Now registering the project so it gets an address.");
+        deps.print("  You're not signed in yet — opening the browser to authorize this device…");
+        try {
+            await deps.runLogin();
+        }
+        catch {
+            deps.print("");
+            deps.print("✗ Sign-in was not completed.");
+            deps.print("");
+            reassure(deps.print, deps.dirLabel);
+            deps.print("  The project was not registered, so no address is reserved yet.");
+            deps.print("");
+            deps.print("  Finish when you're ready:");
+            resume(deps.print, deps.dirLabel, "vincentt create");
+            deps.print("");
+            deps.print("  Nothing else was written.");
+            return 1;
+        }
+        if (!(await deps.currentToken())) {
+            deps.print("");
+            deps.print("✗ Sign-in was not completed.");
+            deps.print("");
+            reassure(deps.print, deps.dirLabel);
+            deps.print("  The project was not registered, so no address is reserved yet.");
+            deps.print("");
+            deps.print("  Finish when you're ready:");
+            resume(deps.print, deps.dirLabel, "vincentt create");
+            deps.print("");
+            deps.print("  Nothing else was written.");
+            return 1;
+        }
+    }
+    // A non-TTY caller must supply both, and the tool never invents an address.
+    if (!deps.ask && (opts.name === undefined || opts.slug === undefined)) {
+        deps.print("");
+        deps.print("✗ Can't register the project without a name and an address, and I can't ask.");
+        deps.print("");
+        reassure(deps.print, deps.dirLabel);
+        deps.print("  No address is reserved yet.");
+        deps.print("");
+        deps.print("  Finish it:");
+        resume(deps.print, deps.dirLabel, resumeCommand);
+        deps.print("");
+        deps.print("  Nothing else was written.");
+        return 1;
+    }
+    const org = await deps.resolveOrg();
+    if (!org.ok) {
+        deps.print("");
+        deps.print(org.message);
+        deps.print("");
+        reassure(deps.print, deps.dirLabel);
+        deps.print("  No address is reserved yet.");
+        deps.print("");
+        deps.print("  Check who you are:  vincentt whoami");
+        deps.print("  Then finish:");
+        deps.print(`  cd ${stripLeadingDotSlash(deps.dirLabel)}`);
+        deps.print("  vincentt create --org <workspace>");
+        deps.print("");
+        deps.print("  Nothing else was written.");
+        return 1;
+    }
+    // AF-3: name the org AND where it came from, before the address prompt. The
+    // card's command carries no --org, so a stale active workspace would otherwise
+    // claim an address in a team org silently.
+    deps.print("");
+    deps.print(`→ Registering in ${org.name} (${ORG_SOURCE_LABEL[org.source]})`);
+    let name = opts.name;
+    let slug = opts.slug;
+    if (deps.ask) {
+        if (name === undefined) {
+            const answer = await deps.ask(`? Project name: (${defaultName}) `, defaultName);
+            name = answer.trim() === "" ? defaultName : answer.trim();
+        }
+        if (slug === undefined) {
+            const fallback = slugify(name);
+            const answer = await deps.ask(`? Address: (${fallback}) `, fallback);
+            slug = answer.trim() === "" ? fallback : answer.trim();
+        }
+    }
+    let attempts = 0;
+    for (;;) {
+        try {
+            return await deps.create({ name: name, slug: slug });
+        }
+        catch (err) {
+            if (!(err instanceof SlugTakenError))
+                throw err;
+            attempts++;
+            // TRAP 3: never auto-pick suggestions[0]. On a non-TTY this refuses; on a
+            // TTY it re-asks with NO default, because there is no safe default left.
+            const canReask = Boolean(deps.ask) && attempts < ADDRESS_REASK_LIMIT;
+            if (!canReask) {
+                deps.print("");
+                deps.print("✗ That address is taken.");
+                deps.print("");
+                reassure(deps.print, deps.dirLabel);
+                deps.print("  No address is reserved yet.");
+                if (err.suggestions.length > 0) {
+                    deps.print("");
+                    deps.print("  Available alternatives:");
+                    for (const s of err.suggestions)
+                        deps.print(`    ${s}`);
+                }
+                deps.print("");
+                deps.print(deps.ask
+                    ? "  Finish with an address of your own:"
+                    : "  Finish with one of those, or your own:");
+                deps.print(`  cd ${stripLeadingDotSlash(deps.dirLabel)}`);
+                deps.print(`  vincentt create --name "${name}" --slug <address>`);
+                deps.print("");
+                deps.print("  Nothing else was written.");
+                return 1;
+            }
+            // A routine, expected collision mid-flow: `!` and a re-ask, not `✗` and an
+            // exit. The command DOES proceed, so a `✗` would announce a stop that is
+            // not happening.
+            deps.print("");
+            deps.print("! That address is taken. Your source is fine — pick another.");
+            if (err.suggestions.length > 0) {
+                deps.print("");
+                deps.print("  Available alternatives:");
+                for (const s of err.suggestions)
+                    deps.print(`    ${s}`);
+            }
+            deps.print("");
+            const answer = await deps.ask("? Address: ", "");
+            slug = answer.trim();
+        }
+    }
+}
+/** The `· from owner/repo@tag` bullet in the start block. */
+export function sourceBullet(ref) {
+    return `  · from ${formatSourceRef(ref)}`;
+}

package/dist/lib/sourceRef.d.ts

@@ -0,0 +1,46 @@
+export interface SourceRef {
+    owner: string;
+    repo: string;
+    tag: string;
+}
+export type ParseFailure = {
+    kind: "missing_tag";
+    value: string;
+} | {
+    kind: "missing_repo";
+    value: string;
+} | {
+    kind: "bad_owner";
+    value: string;
+} | {
+    kind: "bad_repo";
+    value: string;
+} | {
+    kind: "bad_tag";
+    value: string;
+} | {
+    kind: "looks_like_url";
+    value: string;
+    converted?: SourceRef;
+};
+export type ParseResult = {
+    ok: true;
+    ref: SourceRef;
+} | {
+    ok: false;
+    failure: ParseFailure;
+};
+/**
+ * Parse `owner/repo@tag`. Pure: no filesystem, no network, no process.
+ *
+ * A bare `owner/repo` is REFUSED, never defaulted to a branch — a default would
+ * point the command at a moving target (S-2).
+ */
+export declare function parseSourceRef(input: string): ParseResult;
+/**
+ * The clone URL's ONLY composition point. The host is a compile-time constant —
+ * never configuration, never derived from stored data (S-6).
+ */
+export declare function templateCloneURL(owner: string, repo: string): string;
+/** `owner/repo@tag`, the form the creator typed and the card shows. */
+export declare function formatSourceRef(ref: SourceRef): string;

package/dist/lib/sourceRef.js

@@ -0,0 +1,107 @@
+// `--from owner/repo@tag` — the CLI's only writer of the values handed to git.
+//
+// THE PATTERN IS THE SPECIFICATION. Where a comment here and a pattern below
+// disagree, the pattern is the design (f6 S-5).
+//
+// Three parsers accept this grammar (the Go write-boundary validator, this one,
+// and the console's paste parser, which deliberately accepts MORE). The shared
+// row list is `features/f6-gallery/fixtures/source-refs.json`, and every row
+// names the parsers it applies to.
+const OWNER = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+const REPO = /^(?!\.)(?!.*\.\.)[A-Za-z0-9._-]{1,100}$/;
+const TAG = /^(?!.*\.\.)(?!.*\/\/)[A-Za-z0-9._][A-Za-z0-9._/-]{0,127}$/;
+/** A trailing `.git` is refused outright rather than stripped (S-5 fixture row). */
+function validRepo(repo) {
+    return REPO.test(repo) && !repo.endsWith(".git");
+}
+/** git's own check-ref-format rules, on top of the character grammar. */
+function validTag(tag) {
+    return TAG.test(tag) && !tag.endsWith("/") && !tag.endsWith(".lock");
+}
+const URL_LIKE = /^(https?:\/\/|git@|ssh:\/\/|github\.com[/:])/i;
+/**
+ * Best-effort conversion of a pasted GitHub URL to the shorthand, used ONLY to
+ * show the creator the form they should have typed. It never feeds git — a URL
+ * is always a refusal, and this is the remedy line.
+ */
+function convertUrl(input) {
+    const withoutScheme = input.replace(/^(https?:\/\/|ssh:\/\/|git@)/i, "").replace(/^git@/i, "");
+    const path = withoutScheme.replace(/^github\.com[/:]/i, "");
+    if (path === withoutScheme && !/^github\.com/i.test(withoutScheme))
+        return undefined;
+    const parts = path.split("/").filter((p) => p !== "");
+    if (parts.length < 2)
+        return undefined;
+    const owner = parts[0];
+    const repo = parts[1].replace(/\.git$/i, "");
+    // /releases/tag/<tag> and /tree/<tag> are the two forms a creator copies from
+    // a repo page; the tag may itself contain slashes, so take everything after.
+    let tag;
+    if (parts[2] === "releases" && parts[3] === "tag" && parts.length > 4) {
+        tag = parts.slice(4).join("/");
+    }
+    else if (parts[2] === "tree" && parts.length > 3) {
+        tag = parts.slice(3).join("/");
+    }
+    else if (parts.length === 2 && repo.includes("@")) {
+        const [r, t] = repo.split("@");
+        return OWNER.test(owner) && validRepo(r) && validTag(t)
+            ? { owner, repo: r, tag: t }
+            : undefined;
+    }
+    if (tag === undefined)
+        return undefined;
+    if (!OWNER.test(owner) || !validRepo(repo) || !validTag(tag))
+        return undefined;
+    return { owner, repo, tag };
+}
+/**
+ * Parse `owner/repo@tag`. Pure: no filesystem, no network, no process.
+ *
+ * A bare `owner/repo` is REFUSED, never defaulted to a branch — a default would
+ * point the command at a moving target (S-2).
+ */
+export function parseSourceRef(input) {
+    const s = input.trim();
+    if (URL_LIKE.test(s)) {
+        return { ok: false, failure: { kind: "looks_like_url", value: s, converted: convertUrl(s) } };
+    }
+    const at = s.indexOf("@");
+    const slash = s.indexOf("/");
+    if (at === -1) {
+        return {
+            ok: false,
+            failure: slash === -1 ? { kind: "missing_repo", value: s } : { kind: "missing_tag", value: s },
+        };
+    }
+    const left = s.slice(0, at);
+    const tag = s.slice(at + 1);
+    if (!left.includes("/"))
+        return { ok: false, failure: { kind: "missing_repo", value: s } };
+    const firstSlash = left.indexOf("/");
+    const owner = left.slice(0, firstSlash);
+    const repo = left.slice(firstSlash + 1);
+    if (!OWNER.test(owner))
+        return { ok: false, failure: { kind: "bad_owner", value: owner } };
+    if (!validRepo(repo))
+        return { ok: false, failure: { kind: "bad_repo", value: repo } };
+    if (!validTag(tag))
+        return { ok: false, failure: { kind: "bad_tag", value: tag } };
+    return { ok: true, ref: { owner, repo, tag } };
+}
+/**
+ * The clone URL's ONLY composition point. The host is a compile-time constant —
+ * never configuration, never derived from stored data (S-6).
+ */
+export function templateCloneURL(owner, repo) {
+    const url = `https://github.com/${owner}/${repo}.git`;
+    const parsed = new URL(url);
+    if (parsed.host !== "github.com" || parsed.protocol !== "https:") {
+        throw new Error(`Refusing to clone from ${parsed.host}`);
+    }
+    return url;
+}
+/** `owner/repo@tag`, the form the creator typed and the card shows. */
+export function formatSourceRef(ref) {
+    return `${ref.owner}/${ref.repo}@${ref.tag}`;
+}

package/dist/lib/sourceRefCopy.d.ts

@@ -0,0 +1,11 @@
+import { type ParseFailure } from "./sourceRef.js";
+export interface FromFailureContext {
+    /** The target directory as typed, for the runnable remedy line. */
+    dir: string;
+}
+export declare function printSourceRefFailure(print: (line: string) => void, failure: ParseFailure, ctx: FromFailureContext): void;
+/** `--from` with `--template`, or with an install-enabling flag. */
+export declare function printFlagConflict(print: (line: string) => void, conflict: {
+    flags: [string, string];
+    kind: "source" | "install";
+}, ctx: FromFailureContext): void;

package/dist/lib/sourceRefCopy.js

@@ -0,0 +1,80 @@
+// The refusal copy for a `--from` reference that does not parse. Separate from
+// the parser so the grammar stays pure, and separate from the dispatcher so the
+// copy is assertable.
+//
+// Every arm closes with "Nothing was written." — no `else` — because a parse
+// refusal happens before git is ever reached.
+import { formatSourceRef } from "./sourceRef.js";
+export function printSourceRefFailure(print, failure, ctx) {
+    switch (failure.kind) {
+        case "looks_like_url": {
+            print("✗ --from takes owner/repo@tag, not a URL.");
+            print("");
+            if (failure.converted) {
+                const short = formatSourceRef(failure.converted);
+                print(`  From that URL:  ${short}`);
+                print("");
+                print(`  vincentt init ${ctx.dir} --from ${short}`);
+            }
+            else {
+                print("  The gallery card shows the reference in that form.");
+            }
+            break;
+        }
+        case "missing_tag": {
+            print("✗ --from needs a version: owner/repo@tag");
+            print("");
+            print(`  You gave:  ${failure.value}`);
+            print(`  Try:       ${failure.value}@<tag>`);
+            print("");
+            print("  The gallery card's command already includes the tag.");
+            break;
+        }
+        case "missing_repo": {
+            print("✗ --from needs a repository: owner/repo@tag");
+            print("");
+            print(`  You gave:  ${failure.value}`);
+            print("");
+            print("  The gallery card's command already includes the owner and the repository.");
+            break;
+        }
+        case "bad_owner": {
+            print(`✗ "${failure.value}" is not a valid GitHub owner.`);
+            print("");
+            print("  --from takes owner/repo@tag.");
+            break;
+        }
+        case "bad_repo": {
+            print(`✗ "${failure.value}" is not a valid repository name.`);
+            print("");
+            print("  --from takes owner/repo@tag.");
+            break;
+        }
+        case "bad_tag": {
+            print(`✗ "${failure.value}" is not a valid tag.`);
+            print("");
+            print("  --from takes owner/repo@tag.");
+            break;
+        }
+    }
+    print("");
+    print("  Nothing was written.");
+}
+/** `--from` with `--template`, or with an install-enabling flag. */
+export function printFlagConflict(print, conflict, ctx) {
+    const [a, b] = conflict.flags;
+    print(`✗ ${a} and ${b} can't be used together.`);
+    print("");
+    if (conflict.kind === "source") {
+        print("  Both choose which source to scaffold from.");
+        print("");
+        print(`  vincentt init ${ctx.dir} --from owner/repo@tag   Start from a gallery template`);
+        print(`  vincentt init ${ctx.dir} --template 2.1.0        Start from the standard template`);
+    }
+    else {
+        print("  A gallery template is cloned without installing its dependencies.");
+        print("  The install is printed as a next step, to run once you've looked at the source.");
+    }
+    print("");
+    print("  Nothing was written.");
+}